The Agent Skills Directory

[COMMAND_EXECUTION]: The script onebox.sh heavily utilizes docker compose, docker pull, and docker exec to manage the local environment. It also uses curl to interact with remote APIs for fetching application manifests. These operations are standard for the tool's purpose of orchestrating a local Docker stack.
[DATA_EXPOSURE]: The skill manages sensitive configuration such as Docker registry authentication (PULLER_AUTH) and API tokens (MANIFEST_STORE_READ_TOKEN). These are stored in local environment files. The script includes security best practices by recommending restrictive file permissions (chmod 600) and automatically adding sensitive files to .gitignore to prevent accidental commits.
[DYNAMIC_EXECUTION]: The script uses eval to load configuration variables processed by an inline bun script. The processing includes sanitization that replaces newlines with spaces and strictly formats output as key-value pairs, which effectively mitigates potential injection risks during runtime configuration loading.
[REMOTE_CODE_EXECUTION]: The skill downloads and runs Docker images from a registry defined by the user. While this involves executing external code, it is the primary and intended function of the tool. A static analysis flag for a reverse shell was investigated and determined to be a false positive; the identified code pattern (/dev/tcp/127.0.0.1/) is used exclusively for checking local port availability.

portal-dev-setup